From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0087.outbound.protection.outlook.com [104.47.34.87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 2363E21DF806A for ; Tue, 29 Aug 2017 06:59:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector1-amd-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=24BYA9QEKjWr4vNMJX2vEmtV8rq+Jqho+V9+7Wz+zvE=; b=VY2aGGNsA5XPwUuYnDChmiZ7VNtHTu+yqclaFmltJfHhT3f5vEtsWIaVNOM1NEFojYps7tOfhitRTTOcrxGY1fq0WWdnBx7QEnSYx0TCeUlqE2DbJRo5TyN25bx8UvOFbW9rx88L77yAx7/WPYEf9wQ84WBJZHYqfidVSKFNnDQ= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; Received: from [10.236.136.62] (165.204.77.1) by SN1PR12MB0158.namprd12.prod.outlook.com (10.162.3.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1385.9; Tue, 29 Aug 2017 14:02:30 +0000 Cc: brijesh.singh@amd.com, Jordan Justen , Tom Lendacky To: Laszlo Ersek , edk2-devel-01 References: <20170828123928.14627-1-lersek@redhat.com> <20170828123928.14627-2-lersek@redhat.com> From: Brijesh Singh Message-ID: <0d02d683-d124-0e55-ea29-073708dc2ca9@amd.com> Date: Tue, 29 Aug 2017 09:02:25 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: <20170828123928.14627-2-lersek@redhat.com> X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: MWHPR15CA0031.namprd15.prod.outlook.com (10.173.226.145) To SN1PR12MB0158.namprd12.prod.outlook.com (10.162.3.145) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f4996351-5adf-461b-a066-08d4eee69733 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254152)(300000503095)(300135400095)(48565401081)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095); SRVR:SN1PR12MB0158; X-Microsoft-Exchange-Diagnostics: 1; SN1PR12MB0158; 3:eeKkwzZOlKnt1cLzCTiH+rJbWj9LSZ/Glj6xlZl+YlClJKvWnEY2kGRfArqbz9xv19G/FudRRDq8E9eQfxcunNEWmN6uNJv2PR6aMbfhQ2LyWKcF6VMUzmervH2SjQA52KUbKLEF74v4fGpIA/hoh6x6H4IdKcKY7w7uJNunDC+00Be8bSvKte1OcnZwP6zmZuxEqnUUyTC3e1hC0laECJPAjUnR7jLoGs1cGwg2rNNR847YkX4epjImdMu3rI8I; 25:JgsSlkxq7gnOYq+MJ8fpk9VB0HZFTXcLDaIRsH80HX+3mxs4rgRJ4wlFLNdOqUguDbmYD4PiqAPDP0z2Zaa4oHdUEZA+chMi7lBtdGMzibd9f9+aNADqiimmNXAJfjvPIU8RTPxfUlkO7fW9fJ32r+hYorh6hwLptBrzMJIDQ6tFZz3f2ScVsHke7lc0nJMq6sqKNFejCS1soSFt78M2Njp3e1UnRNwu8FOmysUWit2ox7WYlhYblfT1TkFDzTtavXLY9ZysyKxlIPuc5fqSBMzpctftMIdKd9RMYfSHFRGnzpp8f90tp7GSK4nZVNuUKON6UwURisJrBilUqdPJ1w==; 31:odL5zoXxwiTFQIm7RQ/Nv+hrkrrdA+6KPU3bPTj0h5Dc043+sNIKMlOPoDYbnx9OYuuYq9tE+g9OACHV12+x4+Hd2T5rE6Wpvm/MMVoFYoNrklxkmC2DafKlniuxlfN7j9IyXSih9+jOED0dxGblQTGIWyH7CDHiBfklDwFZUWH38PFcEPP/mN1QqU+aHLzEKRQyvjukUTsEVh79l80NOP3ZBNKbZ6Wxfij/eBWhc2o= X-MS-TrafficTypeDiagnostic: SN1PR12MB0158: X-Microsoft-Exchange-Diagnostics: 1; SN1PR12MB0158; 20:AjhjhywBOB6sfr2XHxpQlqAzIKku53YPae6O94ByXkHo+a9r9msfE3jAiMggsaM5bO2SRniIe97tVAogJoDj0EAUN2vfraApgThX+dHGJIXd4gf7O4ilx8DZs8biVU7TTn+RVJhBDSvPvYH+g6+x2MMXfcNiElZ+542x/buHShT46emz8CHReOitqd9DinK+jGtA+Ih1gXbX8KHoRLKj3OxmOiI04qVXb8mjIaB1cbYegtXIo7yesYB6dZrfWvZBYex7y80kHawr96Xqc8rUUNhAacbL0DuPQB2nqDLpSFQGi7ZTGC3j1BEeuZy7PsdlMS02KXZVbtK6kJcyTyiduTN/S8BCLAbYjQ1bFo5imh70et+iQwNAR5YygPo8emPo1yvbtXtxTfvOi8rPW5+NhyFVdK/k25VUy1AhbSkWbf8CvFXiJ1EhohuQzOVgxkDqRfJfCGiECOQcYSKxeuFLCj3nqc5sogbtKxlCKAN4nDBe8bOs7cAoJnpudDVGMqr/; 4:Zd7UJPgeGq6suWa/iOVEObl9umAaue+7Pto3a0t1OB9KJ5ZOSq18xbcdlHHGtEKZDJoLLXlZlyICZrs8imfMCxZCOK7XZiXszlgEu8hN9QwMndwQAaJvejvQt9xgVmDYyD9oW9eEdPRsmHm5OzeDrTTwZEKc6AZqKsNDp65GL1Udnvc9O4pyqCcRD87JhG47sZNFxvPxixR+halcF+VYzPSb8op9BjYVZTL9YOyMSHUKXIXguaWEe/5RuMalYgJnEbgXnkEDFh4D4DzokaVLBt2cE7gFHGipxYlhtuTYp7L8nD9m2s9NSpXItOK3cvDfljvgFeNYzDEBNaIk1tr78w== X-Exchange-Antispam-Report-Test: UriScan:(767451399110)(228905959029699); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006095)(93001095)(100000703101)(100105400095)(6055026)(6041248)(20161123560025)(20161123564025)(20161123562025)(20161123555025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095); SRVR:SN1PR12MB0158; BCL:0; PCL:0; RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095); SRVR:SN1PR12MB0158; X-Forefront-PRVS: 0414DF926F X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(4630300001)(7370300001)(6049001)(6009001)(6029001)(39860400002)(199003)(377454003)(189002)(24454002)(53546010)(86362001)(77096006)(90366009)(97736004)(105586002)(8676002)(106356001)(31686004)(2950100002)(64126003)(3846002)(6116002)(230700001)(68736007)(31696002)(6486002)(189998001)(6666003)(83506001)(76176999)(54356999)(101416001)(50986999)(7736002)(4326008)(50466002)(47776003)(5660300001)(36756003)(305945005)(66066001)(33646002)(65956001)(65806001)(65826007)(81156014)(81166006)(54906002)(229853002)(25786009)(2906002)(42186005)(478600001)(53936002)(7350300001)(23676002)(4001350100001)(6246003); DIR:OUT; SFP:1101; SCL:1; SRVR:SN1PR12MB0158; H:[10.236.136.62]; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtTTjFQUjEyTUIwMTU4OzIzOlJHeWJGdDJGVHZxbFU4c1ZWcGltZTlCbTFi?= =?utf-8?B?eTloWDNtdzdQOWY0MnlLWUQ2SjJwYzBZZERQOWtmKzNDbmduSUdpcElMbFZs?= =?utf-8?B?emtuYUQxWTUrUHBjZCtSdFNHd2oxVWhjOG96K1dRNTVmeGFXZFBmUml2emIw?= =?utf-8?B?UHRWRGlhTzFob3VCeVMyVkhVWTJaQllXKzhQcEZOVWdEUjFtUGs0TmNrUndZ?= =?utf-8?B?NnpoNGlFVWxvdGdwWDJjNDJXdEd1eTJMTnpxUUdqL0FJazFOc1h1enNoSDhj?= =?utf-8?B?RURCakVkNnludmZadzBxSGljMFR4emNaZmZHdmlaZkNVYk9tOHFVTGIzMDM1?= =?utf-8?B?S3d2ZFlETjFKZm81dDIwZEplWnVrTUNMb1VFR1lSRUhPbkhhSVowNUhnUmM4?= =?utf-8?B?MnExOWtnSlM3aStoc3pQWTBlOWx4a2dWV09Pclp3ZkYrT2x3bDhaUzlYYUFG?= =?utf-8?B?T0NMUzFpY04xaW5Ub2dEeVllY20wZjFJVjVnYVVJQTRtWFFudXJkb052Z2s3?= =?utf-8?B?Z1pXMFBSNjZEeG9YbVl3clI5SmJRRlJuMm14eGxIb2NXMjRYMml4S2dEMmRT?= =?utf-8?B?aklISjZ5NzZHdUtxQUEzNWhTSGRsZmxrcEZNRWs3dlF0ZmVjYzBXdnI5cHpV?= =?utf-8?B?eGY5aUVlaTBaV25YSGlnd1pscldaa3Y3RURBQ1BvRENweUpsZTFhNFdIUFhH?= =?utf-8?B?NThzNUJNc0dHUDl0aFZrYUxBbXc1Qm5OKzU4Y3hNM0xQQjF4bUxoNURQVFlE?= =?utf-8?B?c1A0WXAxdStrWmNpZmMxdElEbXNmSThkV21lZ0phdWRGZUhsK3gxWVNyNlVa?= =?utf-8?B?MXl1VHZLaEdBYkZ2L2NaUkY0Nm54ZXRoVkhDWGYvME45TVU1U2gxZUozNml1?= =?utf-8?B?K0J2VHlFbjlQc2JKNzloNmNTOC9Hb1hUYlF0Y3FzUUF5OXFXV3NSWm9VcFRi?= =?utf-8?B?SytkVHloU2Rlc3RmbDU2bFEwdDk5d2tDSXB4NktPc0ZIY2tGbWdFOGpnNTZx?= =?utf-8?B?YVowcXNUUVhkV0ZHajB2djBpV1RXYVZUekFzTmtaeWxQYkl3eGlZUUI2VHp0?= =?utf-8?B?SUZHSVUzUzhSWTd0NXZWNUIvRk9Hak5JVUg0TGFITzl6UE12TTR4VHRWNGVt?= =?utf-8?B?Z1gvWVZ1bndoSi96d2Z6cVFmZTk0dDUwcDkxaXd5djR5VVBsbDNhRVV4Z3hh?= =?utf-8?B?dnozeW1XU3RkSE04ZnFIQUR6VGJxckVEOGJXZUFCMk9CNlRZRVFJL093NElT?= =?utf-8?B?RFozVkhSblVkV2xIU1dDb3B5aldUSDBZRFNkbzJ5NW9SbU5qVFZGVGFuOWY4?= =?utf-8?B?OHNUR0NVSWxWNHYvTDkzQmJJUVZJTnhmMFZaNXNlTklRNXN0RmZ4K0Y2Q3d3?= =?utf-8?B?WnFJK244VE9wejJtT2t5ZmVpM21WaDdMbFVKdTZQUVNmR2dtd2JhSEJvdEJv?= =?utf-8?B?YjU2clFySHJraGd6UCszYnJ1MzlHd1NNTHFhZWtqRW1HdW9YZWRVYTlXckMx?= =?utf-8?B?S3ptcHhscUM5R2JQNy8zOHJjS2pzRWU2WHFGS1FQeXo2NkV5OVh4RVI1Wm1w?= =?utf-8?B?TFQ2MXZKRXpaMkVhRm5YSVpKZ1dTcWhOaXRiQ0xLTU9WMUZvNWM0ZjgzM3p3?= =?utf-8?B?c0JhdUNCU0tIT0dHQlI4ZjJIWjBLQXMzZng2dGVvcC9MQ3djUDFRaElNWmVr?= =?utf-8?B?RngxM2wvYjQrNTlEczl2dFZOaTlZN2hpUU1icXdpdGR0ZkdMQXpCcVFLaEFs?= =?utf-8?B?dUhMNWJkUVE4b0lvOW8vUkM3QUNNaHBzN0k1WEVTSFZScFpUNHViL3lHL0dz?= =?utf-8?B?aTJtUk5XWEltdWtnbDRFeTdIWmJDbDJyNVplbkNBWWhEb0dFWTFwek1CQzBm?= =?utf-8?B?TWtuUmZ4YlF2MHRLUDFML05OS1ZPbXQ1Z1gxdGxUaG1vZlUxUTBTNDdwcmtM?= =?utf-8?B?WFR0TmMzY2tBPT0=?= X-Microsoft-Exchange-Diagnostics: 1; SN1PR12MB0158; 6:d8ExjJkVlinkaXw/CtYSpzynihGzxmwQAtU0mq3Ju1bRu5eMnfVeqcP1ZFM8I8pdn18BMP4KWO2r33uvtY6bYZ3UziULgPyp8oRPJ1VEGQMqse0IPSP8+sVt/YB8comX7QYm+e0zdOiCnvjZaSO+Muhx5knzHz8ZQN9MAEgCrVHM5snBrPOos7ustgKS9UMmX8UqNKbQFFO9R7K6CE9SA4qWyEfRql9ZVdhY8TPWFQ/fte5d7d44XBNgIW+gFtq+j5Yt+Rm5PaJL4kjtzQmRW0i4YSF4hGB2cSF+RoV68bwVAIknvkdN9F1raWtKgl6e/hFYwmxhcbMowdYQ4a/Sqg==; 5:h4su/KRNScazdsfE7aFTZcCC7SR4E5p9pRQBuyBzklir+N8olDNaWAsGEDWP9FupqROfAPJ3ID4/dZkvaheJVQNuYFRxuK1zYat9ulqE0XD7uUSqKw1TQZsgiB9vDVIte5htwQTId/IKb7WUJwmX8w==; 24:ny4UNSWv6+hAcFz2+ni+5YMf0Rl9cvREN0T1oquebxsinE5FUO5ch+ojxWnII5eZoB7mRTCwC02v3RX8xFScFHwp4W1PqfL2fQu41JMnLo4=; 7:kwPMt413XvAYM3/qoi3Kcm/Y473JHmozPWQpoqqMWKQ5bsKGhZPZ0ly6OByg9sxWcFlH//Da+Oxe368NxgarvPdVi4dxipsmAWPW8Xib7UwDe4dKvI4zEXVPbBFm1qDiUbUeAHhzq+J+oMUm8AELgudn4M4jfaaV8JhG0KZh2x2OfTGLM7ffFicJyapVV5gedpNG1D9i0HTier9yIwL8l7AHzm6GwpG038e/V177nfc= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; SN1PR12MB0158; 20:6eXEE0f8y3bLGtrRCg+fGXFJhJEUQft9yA0YXEjwh4E2g5QAVRrX5Xc730CORhxJgBCElZ3gw5n1wM9m+3ZlDWXHrusebc8gc/aAYEjj0x32Ff86HSToE9hr1sLnLhjAHChUZg/kG9n8nJIpDswALQa41/IsMfLWsf9Do01HbbzO9K6OYS2SsqzdB4W98H4EYbUIOwZHGH26d/XNOI1snybyNgEaFVN3NONuOvCK0TGXJs3wzfoiscwDBNNzNSEc X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Aug 2017 14:02:30.4901 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0158 Subject: Re: [PATCH 1/1] OvmfPkg/QemuFwCfgDxeLib: SEV: zero FW_CFG_DMA_ACCESS before decrypting it X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Aug 2017 13:59:52 -0000 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit On 08/28/2017 07:39 AM, Laszlo Ersek wrote: > There's a small window between > > - AllocFwCfgDmaAccessBuffer() mapping the new FW_CFG_DMA_ACCESS object for > common buffer operation (i.e., decrypting it), and > > - InternalQemuFwCfgDmaBytes() setting the fields of the object. > > In this window, earlier garbage in the object is "leaked" to the > hypervisor. So zero the object before we decrypt it. > > (This commit message references AMD SEV directly, because QemuFwCfgDxeLib > is not *generally* enabled for IOMMU operation just yet, unlike our goal > for the virtio infrastructure. Instead, QemuFwCfgDxeLib uses > MemEncryptSevLib explicitly to detect SEV, and then relies on IOMMU > protocol behavior that is specific to SEV. At this point, this is by > design.) > > Cc: Brijesh Singh > Cc: Jordan Justen > Cc: Tom Lendacky > Contributed-under: TianoCore Contribution Agreement 1.1 > Signed-off-by: Laszlo Ersek Reviewed-by: Brijesh Singh